Skip to content
Makeplane Plane vulnerabilities
-
makeplane plane
makeplane API Endpoint reliance on untrusted inputs in a security decision
CVE-2026-111869
6.9 Medium
-
makeplane plane
Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope
CVE-2026-102980
6.5 Medium
-
makeplane plane
Plane: Any project member can modify (deactivate) other members' records
CVE-2026-102985
6.5 Medium
-
makeplane plane
Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/
CVE-2026-102986
8.1 High
-
makeplane plane
Plane: Unauthenticated Workspace Invitation Token Leakage
CVE-2026-102981
6.5 Medium
-
makeplane plane
Plane: XSS in work item comments
CVE-2026-102982
8.5 High
-
makeplane plane
Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)
CVE-2026-102988
5.3 Medium
-
makeplane plane
Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
CVE-2026-105641
9.8 Critical
-
makeplane plane
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
CVE-2026-105640
9.1 Critical
-
makeplane plane
Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
CVE-2026-105639
9.8 Critical
-
makeplane plane
Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
CVE-2026-105638
9.1 Critical
-
makeplane plane
Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)
CVE-2026-105637
9.6 Critical
-
makeplane plane
Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
CVE-2026-105636
9.9 Critical
-
makeplane plane
Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token
CVE-2026-105635
7.4 High
-
makeplane plane
Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles
CVE-2026-105634
8.1 High
-
makeplane plane
Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope
CVE-2026-105633
7.1 High
-
makeplane plane
Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects
CVE-2026-105632
8.7 High
-
makeplane plane
Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure
CVE-2026-105631
7.5 High
-
makeplane plane
Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)
CVE-2026-105630
8.7 High
-
makeplane plane
Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup
CVE-2026-105629
7.1 High
-
makeplane plane
Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint
CVE-2026-105628
7.6 High
-
makeplane plane
Plane: Cross-tenant stored XSS in intake enables account takeover
CVE-2026-104979
8.7 High
-
makeplane plane
Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance
CVE-2026-104978
8.2 High
-
makeplane plane
Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU
CVE-2026-104977
7.7 High
-
makeplane plane
Plane: SSRF in Gitea OAuth
CVE-2026-104976
8.7 High
-
makeplane plane
Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints
CVE-2026-104975
7.1 High
-
makeplane plane
Plane: Disabled User Auto-Reactivation on Login
CVE-2026-104974
8.1 High
-
makeplane plane
Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery
CVE-2026-104973
7.6 High
-
makeplane plane
Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization
CVE-2026-104971
8.5 High
-
makeplane plane
Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins
CVE-2026-104970
8.1 High
-
makeplane plane
Plane: Cross-Tenant Cycle Issue Hijack via IDOR
CVE-2026-104969
6.5 Medium
-
makeplane plane
Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/
CVE-2026-104968
8.7 High
-
makeplane plane
Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint
CVE-2026-104967
5.4 Medium
-
makeplane plane
Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces
CVE-2026-104966
8.7 High
-
makeplane plane
Plane: Cross-Tenant Issue Relation Creation via IDOR
CVE-2026-104965
5.4 Medium
-
makeplane plane
Plane: Cross-Workspace Project Modification via Unscoped Project Lookup
CVE-2026-104964
6.8 Medium
-
makeplane plane
Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member
CVE-2026-104963
4.3 Medium
-
makeplane plane
Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)
CVE-2026-104962
6.5 Medium
-
makeplane plane
Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access
CVE-2026-104961
5.4 Medium
-
makeplane plane
Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users
CVE-2026-104960
6.5 Medium
-
makeplane plane
Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)
CVE-2026-104956
5.3 Medium
-
makeplane plane
Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)
CVE-2026-104955
5.4 Medium
-
makeplane plane
Plane: Cross-Tenant Module Issue Linking via IDOR
CVE-2026-104894
4.3 Medium
-
makeplane plane
Plane: Improper validation allows arbitrary modification of API token rate limits
CVE-2026-104893
5.4 Medium
-
makeplane plane
Plane: Plaintext logging of API token
CVE-2026-104892
8.7 High
-
makeplane plane
Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board
CVE-2026-86174
5.3 Medium
-
makeplane plane
CVE-2026-15342
CVE-2026-15342
6.5 Medium
-
makeplane plane
Plane 1.3.1 - Stored XSS in intake issue description_html
CVE-2026-10850
6.9 Medium
-
makeplane plane
Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces
CVE-2026-46558
Public exploit
8.3 High
-
makeplane plane
Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics
CVE-2026-40102
6.5 Medium
- Show olderLoading…